Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Cpu

Cpu - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 43 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description claim CPU monitoring (load, temperature, process ranking). The shipped script does not read system metrics (no /proc, no ps/top, no sensors calls). Instead it primarily accepts user-provided input and appends it to log files under ~/.local/share/cpu. Commands listed in SKILL.md (e.g., cpu run, cpu list, cpu add) do not match the script's command set (scan, monitor, report, etc.). This mismatch suggests the implementation does not match the stated purpose.
!
Instruction Scope
SKILL.md instructs users about configuration (CPU_DIR) and monitoring usage, but the runtime script ignores CPU_DIR and uses HOME/.local/share/cpu. The script's behavior is limited to creating a data directory and writing/reading log files; it does not attempt to access other system-wide config or network endpoints. Still, the SKILL.md's instructions are misleading about capabilities and configuration.
Install Mechanism
No install spec (instruction-only) and included script.sh is present. Nothing is downloaded or installed from external URLs. This is low-risk from an installation perspective, but the script will be written/executed locally if the agent runs it.
Credentials
The skill declares no required env vars, but SKILL.md suggests setting CPU_DIR while the script does not honor that variable and instead uses $HOME/.local/share/cpu. The script implicitly depends on HOME and common shell utilities (grep, wc, du, tail), which is reasonable but the documentation/config mismatch is a red flag.
Persistence & Privilege
The skill does not request always:true, does not modify other skill configs, and confines writes to a per-user data directory under the user's home. It does not request elevated privileges or external credentials.
What to consider before installing
This package appears coherent as a simple local logger, but its documentation claims CPU monitoring features it does not implement and it misstates configuration behavior (CPU_DIR vs actual use of $HOME/.local/share/cpu). Before installing or running it, consider: 1) Inspect the full script (you already have it) and confirm it meets your needs — it doesn't collect CPU metrics. 2) Run it in an isolated environment (container or throwaway account) if you want to test. 3) Don't run it as root; it writes files under your home directory. 4) Ask the author for clarification/corrected code if you expected actual monitoring/temperature/process sampling. 5) If you need real system monitoring, prefer well-known tools (top/htop, ps, sar, collectd, prometheus exporters, lm-sensors) that explicitly access system metrics. If the script is accepted, be aware it will create and write logs to ~/.local/share/cpu and will store any text you pass to its commands there.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk9759c30nx2wdw6kspj3rwkwc1830h54

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Cpu

CPU monitor — load tracking, process ranking, temperature, and performance history.

Commands

CommandDescription
cpu helpShow usage info
cpu runRun main task
cpu statusCheck state
cpu listList items
cpu add <item>Add item
cpu export <fmt>Export data

Usage

cpu help
cpu run
cpu status

Examples

cpu help
cpu run
cpu export json

Output

Results go to stdout. Save with cpu run > output.txt.

Configuration

Set CPU_DIR to change data directory. Default: ~/.local/share/cpu/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Features

  • Simple command-line interface for quick access
  • Local data storage with JSON/CSV export
  • History tracking and activity logs
  • Search across all entries
  • Status monitoring and health checks
  • No external dependencies required

Quick Start

# Check status
cpu status

# View help and available commands
cpu help

# View statistics
cpu stats

# Export your data
cpu export json

How It Works

Cpu stores all data locally in ~/.local/share/cpu/. Each command logs activity with timestamps for full traceability. Use stats to see a summary, or export to back up your data in JSON, CSV, or plain text format.

Support

Powered by BytesAgain | bytesagain.com

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…